CoChat
Sign Up
Cited by 52Cryptography and Data SecurityCryptographic Implementations and SecurityAdversarial Robustness in Machine Learning

Neural Networks-Based Cryptography: A Survey

Open access
Meraouche, Ishak, Dutta, Sabyasachi, Tan, Haowen, Sakurai, Kouichi·2021·IEEE Access
DOI 10.1109/access.2021.3109635
Open this paper in CoChat — free accountOpen PDF

Abstract

A current trend of research focuses on artificial intelligence based cryptography which although proposed almost thirty years ago could not attract much attention. Abadi and Anderson’s work on adversarial cryptography in 2016 rejuvenated the research area which now focuses in building neural networks that are able to learn cryptography using the idea from Generative Adversarial Networks (GANs). In this paper, we survey the most prominent research works that cover neural networks based cryptography from two main periods. The first period covers the oldest models that have been proposed shortly after 2000 and the second period covers the more recent models that have been proposed since 2016. We first discuss the implementation of the systems from the earlier era and the attacks mounted on them. After that, we focus on post 2016 era where more advanced techniques are utilized that rely on GANs in which neural networks compete with each other in order to achieve a goal e.g. learning to encrypt a communication. Finally, we discuss security analysis performed on adversarial cryptography models.

AI snapshot

Written from the paper’s full text.

TL;DR

This survey reviews neural-network-based cryptography across two periods: early Tree Parity Machine key agreement and post-2016 GAN-based adversarial cryptography. It traces attacks, security analyses, and improvements, especially the shift toward learning One-Time Pad-like encryption against stronger adversaries.

Key findings

  • The early Tree Parity Machine (TPM) key-exchange model was broken by Klimov et al. using genetic/passive, geometric, and probabilistic attacks; later improvements include the Permutation Parity Machine, whose successful-attack probability is given as low as \(10^{-20}\) when \(N=16\) and \(G=128\), and an optimal TPM structure using \(K=8\), \(N=16\), \(L=2^3\) that produced a 512-bit key with 0% success for passive and geometric attacks in over 10 million simulations.
  • Abadi and Andersen’s 2016 GAN-based model trains Alice and Bob to communicate while Eve tries to reconstruct the plaintext; training aims for Bob’s accuracy near 100% and Eve’s near 50%, but Zhou et al. found via \(\chi^2\), Kolmogorov-Smirnov, and NIST tests that the majority of ciphertexts were not secure/random.
  • Zhou et al. also showed that training against stronger Eves can improve security: with Eve given 4 bits of the key, Bob reached 100% accuracy and Eve slightly below 50%; with 8 bits of the key, Bob could not converge and Eve exceeded 0.5 accuracy.
  • Coutinho et al. changed the network structure to learn the One-Time Pad, reporting up to 100% successful communications and 95–100% learned OTPs; Zhengze et al. trained against three Eves and reported 100% successful communication across five 2048-trial runs, with OTPs learned between 98.9% and 100%.

Methods

  • Design: a survey of neural-network-based cryptography, organized into early pre-GAN work and post-2016 GAN/adversarial cryptography.
  • Data/sample: cited research works from roughly 2000–2020, including TPM key agreement, attacks on it, GAN-based encryption, steganography, multi-party adversarial cryptography, and security analyses.
  • Main analysis: narrative description plus summary tables of contributions, techniques, vulnerabilities, and security results; the paper does not report new primary experiments.

Limitations

  • The survey states that neural-network-based cryptography is still in a nascent stage, with public-key cryptography and secret sharing remaining open directions and low-capacity-device friendliness as an ongoing research trend.
  • It reports limitations of surveyed models: Abadi et al.’s ciphertexts have repetitive patterns and are weak against probabilistic attacks; Coutinho et al.’s OTP relies on a pseudo-random generator and remains vulnerable without quantum computers; Zhengze et al.’s three-Eve training requires substantial resources and time.
  • Evident from the text: several surveyed works lack security analysis, including the topology-evolving neural-network model and the 3D cube key-generation method, and Salguero et al. provide no insights regarding probabilistic attacks.

Model-written summary. Check it against the paper before relying on it.

Integrity signals

Registry

Crossref · 10.1109/access.2021.3109635

Cites

58 of 58 references verified0 citation errors · 0 not checkable

Statistics

Nothing to recompute.

Claims the paper makes

0 of 107 cited sources checked · 0 supported · 0 flagged

  • Premisecitation

    One of the first papers related to neural networks based cryptography was in 2000, showcasing a secure key exchange through synchronization of two neural networks.

    “One of the first papers [10] related to this research direction was back in 2000, showcasing a secure key exchange through the synchronization of two neural networks.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [10]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Premisecitation

    Abadi and Andersen initiated a research direction on learning to protect communications with adversarial neural cryptography.

    “However recently, Abadi and Andersen [13] initiated a research direction on learning to protect communications with adversarial neural cryptography.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [13]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Premisecitation

    The idea of Kanter et al. consists of two Tree Parity Machines synchronized to convey a key securely in the presence of passive eavesdroppers.

    “The idea consists of having two neural networks called Tree Parity Machines (TPMs) and synchronize them to convey on a key securely in the presence of passive eavesdroppers that have access to the communication but cannot change or replay messages.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [10]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Premisecitation

    After GANs, a research spurring paper appeared in late 2016 featuring two neural networks learning a symmetric key encryption system in the presence of an adversary.

    “After the development of GANs, a research spurring paper appeared in late 2016, featuring two neural networks learning a symmetric key encryption system in the presence of an adversary [13].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [13]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Premisecitation

    Klimov et al. analysed and showed that Kanter et al.'s work is insecure and impractical as it is vulnerable against different attacks.

    “Klimov et al. [12] analysed and showed that the work done by Kanter et al. [10] is insecure and impractical as it is vulnerable against different attacks that are explained below.”
    Quote in the paperNot a substantial claim0 of 2 sources checked
    • cites [12]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [10]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • May combine two claims. 35
  • Classified as probably not a substantial claim. 27
  • The quote only partly states this claim. 2

  • May combine two claims.

    Premisecitation

    Following Abadi and Andersen's work, a flow of research appeared to study the security of their model, extend it to an assumed perfectly secure protocol, and more.

    “Following Abadi and Andersen's work [13], a flow of research appeared in order to study the security of their model (e.g.[18]), as well as extend it to an assumed perfectly secure protocol [19], and many more [20]- [23].”
    Quote in the paperNot a substantial claim0 of 3 sources checked
    • cites [13]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [18]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [19]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    Kanter et al. were among the first researchers to use machine learning to learn cryptography.

    “Kanter et al. [10], were among the first researchers to make use of machine learning to learn cryptography.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [10]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • May combine two claims.

    Premisecitation

    Several follow-up works studied the security of Abadi et al.'s model, ported it to steganography, or improved its security.

    “Several follow up works performed a study on the security [18], ported it to steganography [20], [21] or improved its security [19].”
    Quote in the paperNot a substantial claim0 of 3 sources checked
    • cites [18]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [20]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [21]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • May combine two claims.

    Premisecitation

    The genetic attack simulates a population of neural networks with the same structure as Alice and Bob, trains them with the same public inputs, and those whose outputs are similar synchronize with the targets and can read the communication.

    “The general idea is to simulate a big population of neural networks that have the same structure as Alice and Bob and train them with same public inputs.The neural networks from the population whose outputs are similar to the two targeted neural networks, are now synchronised with the targets and can read the communication between them.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [12]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    Abadi and Andersen's model aims to create neural networks that can learn to encrypt a communication without being taught any specific encryption algorithm.

    “Specifically, it aims to create neural networks that can learn to encrypt a communication without being taught any specific encryption algorithm.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [13]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • May combine two claims.

    Premisecitation

    Kanter et al. proposed a popular key agreement protocol in 2001 showing two neural networks can learn to exchange a secret key without using known cryptography methods.

    “One very popular protocol by Kanter et al. [10] was proposed during the year 2001 and showed how two neural networks can learn to exchange a secret key without using any sort of known cryptography methods.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [10]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • May combine two claims.

    Premisecitation

    Machine learning can help learn from data generated by cryptographic algorithms and detect significant patterns.

    “Machine learning can help learn from the data generated by the cryptographic algorithm and detect significant patterns [6]- [8]”
    Quote in the paperSubstantial claim0 of 3 sources checked
    • cites [6]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [7]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [8]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • May combine two claims.

    Premisecitation

    Several cryptographic protocols using machine learning and deep learning models proposed in the late 1990s and early 2000s were deemed insecure and concrete attacks were shown subsequently.

    “In late 90's and early 2000's, several cryptographic protocols using machine learning and deep learning models were proposed such as [9]- [11], but were deemed insecure and even some concrete attacks [12] were shown subsequently.”
    Quote in the paperNot a substantial claim0 of 4 sources checked
    • cites [9]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [10]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [11]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [12]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Classified as probably not a substantial claim.

    Premisecitation

    Spectrum-Diverse Neuroevolution with Unified Neural Models is a type of neural network structure that can evolve by adding or removing neurons to/from its structure.

    “a new topology called Spectrum-Diverse Neuroevolution with Unified Neural Models [23] which is basically a type of neural network structure that can evolve by adding or removing neurons to/from its structure.”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [23]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • May combine two claims.

    Premisecitation

    Abadi et al.'s model is vulnerable against probabilistic attacks and its generated ciphertexts have many repetitive patterns.

    “Vulnerable against probabilistic attacks.The ciphertexts generated have many repetitive patterns.”
    • Also stated in: § 2018 · boosted
      “Prove that the model learned in [13] is weak against probabilistic attacks.”
    Quote in the paperNot a substantial claim0 of 2 sources checked
    • cites [13]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [18]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • Rests on an assumption: The ciphertexts generated by Abadi et al.'s model have many repetitive patterns.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    Coutinho et al. changed the structure of the neural networks so that they learn the One-Time Pad, which is secure against probabilistic attacks.

    “The authors change the structure of the neural networks so that they learn the One-Time Pad which is secure against probabilistic attacks.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [19]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Premisecitation

    Salguero et al.'s optimal TPM structure results in a 0.00004% probability of successful passive attacks and 0% on geometric attacks, with no insights regarding probabilistic attacks provided.

    “Results a 0.00004% probability of successful passive attacks and 0% on geometric attacks.”
    • Also stated in: § Not Applicable 2019 · plain
      “No insights regarding probabilistic attacks provided.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [25]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • May combine two claims.

    Premisecitation

    Seoane et al. demonstrated a successful probabilistic attack on the Permutation Parity Machine, rendering it nonsecure.

    “However Seoane et al. [30] demonstrate a successful probabilistic attack on the Permutation Parity Machine which therefore renders the PPM discussed by Reyes et al. [29] nonsecure.”
    Quote in the paperNot a substantial claim0 of 2 sources checked
    • cites [30]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [29]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    Alice and Bob's goal is to communicate securely by minimizing the error between the original plaintext and Bob's deciphered output text.

    “Alice and Bob's goal is to communicate securely by minimizing the error between the original plaintext and Bob's deciphered output text.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [13]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • May combine two claims.

    Premisecitation

    The results from [37] show that it is possible to implement topology-evolving neural networks and that they can evolve and learn a symmetric encryption protocol.

    “The results from [37] show that it is possible to implement such neural networks and they can evolve and learn a symmetric encryption protocol.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [37]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • May combine two claims.

    Premisecitation

    In Abadi-Anderson's setup, Eve's goal is reconstruction of the plaintext from the ciphertext only, not distinguishing the ciphertext from a random value as in a standard GAN.

    “While in the setup of a GAN, Eve's goal would be to distinguish between the cipher text C and a random value from a certain distribution; Her goal here is the reconstruction of the plaintext from the ciphertext only.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [13]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Classified as probably not a substantial claim.

    Premisecitation

    Eve's goal is to reconstruct the plaintext using the ciphertext only, without knowing the secret key.

    “Eve's goal is to reconstruct the plaintext using the cipher text only i.e. without knowing the secret key.”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [13]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • May combine two claims.

    Premisecitation

    Salguero et al. studied the original TPM and proposed an optimal structure that generated a 512 bits key.

    “Another improvement to the Tree Parity Machine has been done by Salguero et al. [25].They studied the original TPM and proposed an optimal structure that generated a 512 bits key.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [25]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • May combine two claims.

    Interpretationreasoning

    Eve's accuracy needs to be around 50% because in probabilities, when an entity is making random guesses, the worst case is 50% wrong and 50% correct, so one cannot tell which guesses are correct.

    “The reason why Eve's accuracy needs to be around 50% is because in probabilities, when an entity is making random guesses; the worst case scenario is to be 50% wrong and 50% correct.In that case, you can not tell which guesses are correct and which are not.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Premisereasoning

    The only drawback of the adversarial cryptography model is that it takes a considerable amount of time to synchronize two parties for the first time, because they do not have pre-saved parameters.

    “The only drawback is that it takes a considerable amount of time to synchronize two parties for the first time as they do not have pre-saved parameters.”
    Quote in the paperNot a substantial claim

  • Classified as probably not a substantial claim. May combine two claims.

    Premisecitation

    The model consists of two neural networks (Alice and Bob) sharing a secret key k, with the goal to establish secure communication in the presence of an adversary, the third neural network Eve.

    “The model consists of two neural networks (Alice and Bob) sharing a secret key k and their goal is to establish a secure communication in the presence of an adversary, the third neural network (Eve).”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [13]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • May combine two claims.

    Premisecitation

    Increasing the number of hidden units N increases the complexity of the geometric attack exponentially and renders it difficult to conduct.

    “In their study, they deducted that neural networks with a larger value N of the hidden units will increase the complexity of the geometric attack exponentially and therefore render it difficult to conduct.”
    • Also stated in: § 2007 · plain
      “Shows that increasing the number of neurones increases the complexity of the geometric attack exponentially.”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [28]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • May combine two claims.

    Premisereasoning

    In the adversarial cryptography model, the neural networks learn an encryption method on their own without being taught or shown any specific encryption method such as AES, so no specific algorithm with detailed steps needs to be built.

    “The neural networks will work on learning a method on their own without being taught or shown any specific encryption method such as AES.”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [13]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Classified as probably not a substantial claim.

    Premisecitation

    Salguero et al. presume their method is secure enough based on heuristic rule validation showing small parameter changes lead to a polynomial increase in synchronization time.

    “The authors finally validate their results with the heuristic rule and the results show that a small change in the parameters would lead to a polynomial increase of the synchronization time and therefore the authors presume that their method is secure enough.”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [25]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Interpretationnone given

    Training multiple parties to learn an adversarial cryptography scheme might be challenging and time consuming.

    “Talking among multiple parties using Adversarial Cryptography can be a useful feature to be implemented however training multiple parties on learning the scheme might be challenging and time consuming.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Premisecitation

    Reyes et al. conducted comparative attacks on the TPM and PPM; results show the PPM performs better against the attacks proposed by Klimov et al. compared to the TPM.

    “Reyes et al. [29] conduct comparative attacks on the TPM and the PPM.The results show that the Permutation Parity Machine performs better against the attacks proposed by Klimov et al. [12] compared to the Tree Parity Machine.”
    Quote in the paperNot a substantial claim0 of 2 sources checked
    • cites [29]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [12]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Premisecitation

    In the training phase, a random key K and a random plaintext P are generated at every iteration; the key is known to Alice and Bob but not Eve.

    “In this phase, a random key K and a random plaintext P are generated at every iteration.The key is known to Alice and Bob but not Eve.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [13]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Study design and conductcitation

    In these steganography models, a different image/secret-text combination is used at every training iteration in order to prevent Alice and Bob from learning a model specific to one particular image or secret text.

    “A different image/secret-text combination is used at every training iteration in order to prevent Alice and Bob from learning a model specific to one particular image or secret text.”
    Quote in the paperNot a substantial claim0 of 2 sources checked
    • cites [20]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [21]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    Purswani et al.'s results show that the accuracy of the model can increase by up to 21% when the Python built-in random function is replaced with other techniques such as the logistic chaotic key or the Henon key.

    “Their results show that the accuracy of the model can increase up to 21% when replacing the python built-in random function with other techniques such as the logistic chaotic key or the Henon key.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [36]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • May combine two claims.

    Premisecitation

    In Salguero et al.'s simulations, the neural networks synchronized in a maximum of 6 seconds with a 0% success rate for the attacker, using K=8, N=16 and L=2^3.

    “In their simulations, the authors showed a case where the neural networks synchronize in a maximum of 6 seconds with a 0% success rate for the attacker.This was done by using the values K = 8, N = 16 and L = 2 3 for the structure of the TPM.”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [25]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    Kiyomoto et al. provide a good example of automatic security protocol generation.

    “A good example of protocol generation is done by Kiyomoto et al. [34].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [34]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • May combine two claims.

    Premisecitation

    The authors of Neural Cryptography Based on the Topology Evolving Neural Networks do not provide any security analysis as their work focused on establishing a successful communication.

    “The authors do not provide any security analysis as their work focused on establishing a successful communication.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [23]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S4 (based). May combine two claims.

    Interpretationreasoning

    Using neural networks based models for encryption is expected to provide substantial security with reduced CPU usage of IoT devices.

    “As IoT devices work on timelimited batteries, using neural networks based models for encryption is expected to provide substantial security with reduced CPU usage of the devices.”
    Quote in the paperNot a substantial claim
    • Rests on an assumption: Neural network models are usually lightweight, fast and efficient.

  • May combine two claims. The quote only partly states this claim.

    Premisecitation

    All the results of Zhou et al.'s randomness tests show that the majority of ciphertexts generated by Alice are not secure, which makes the model insecure in terms of distinguishability.

    “texts are not secure which makes this model insecure in terms of distinguishability.”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [18]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Classified as probably not a substantial claim. May combine two claims.

    Premisecitation

    As classical computers cannot generate a fully random pattern, the OTP model will not prove useful unless used with a quantum computer.

    “As classical computers cannot generate a fully random pattern, the model will not prove useful unless used with a quantum computer.”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [19]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • Rests on an assumption: Classical computers cannot generate a fully random pattern.

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Premisenone given

    Neural network based cryptography has drawn significant attention with the hope that it could provide post-quantum cryptographic primitives.

    “Neural network based cryptography has drawn significant attention with the hope that it could provide post-quantum cryptographic primitives.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Premisenone given

    The introduction of the OTP by Coutinho et al. and Zhengze et al. solves the problem of randomness and improves the model by Abadi et al.

    “The introduction of the OTP by Coutinho et al. [19] and Zhengze et al. [24] that solves the problem of randomness and improving the model by Abadi et al. [13].”
    Quote in the paperNot a substantial claim0 of 3 sources checked
    • cites [19]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [24]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [13]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • May combine two claims.

    Premisecitation

    By using the new Eve structure, the authors were able to get up to 100% successful communications during their trials and between 95% and 100% learned OTPs.

    “By using this method, the authors were able to get up to 100% successful communications during their trials and between 95% and 100% learned OTPs.”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [19]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S4 (based). May combine two claims.

    Interpretationnone given

    GANs-based neural networks can learn symmetric encryption as well as privacy preserving.

    “observed that GANs-based neural networks can learn symmetric encryption as well as privacy preserving.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisenone given

    Alice and Bob produce more complex ciphertexts.

    “Alice and Bob produce more complex ciphertexts.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [24]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • May combine two claims.

    Premisecitation

    With three Eves, Zhengze et al. got between 97 and 100% successful communications and OTPs learned.

    “But with the 3 Eves, they got between 97 and 100% successful communications and OTPs learned.”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [24]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • May combine two claims.

    Premisecitation

    With 8 bits of key, Eve is much more accurate in her decryption, which pushes Alice to make the encryption method so complicated that Bob cannot converge and get a perfect decryption of the ciphertexts sent by Alice.

    “However with 8 bits of key, Eve is much more accuracte in her decryption which pushes Alice to make the encryption method so complicated that Bob even cannot converge and get a perfect decryption of the ciphertexts sent by Alice.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [18]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Classified as probably not a substantial claim. May combine two claims.

    Premisecitation

    The neural networks learn the one time pad by learning the XOR operation and encrypting each given plaintext with a unique key.

    “Concretely, learning the XOR operation and encrypting each given plaintext with a unique key.”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [19]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Premisecitation

    The authors of [19] propose another model that learns the One Time Pad, which improves the security and the weakness against probabilistic attacks.

    “The authors then propose another model that learns the One Time Pad which improves the security and the weakness against probabilistic attacks.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [19]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • May combine two claims.

    Premisecitation

    With the new Alice and Bob structure, the neural networks were able to communicate but were not able to learn the one time pad.

    “By processing the inputs this way, the authors show that the neural networks were able to communicate but were not able to learn the one time pad.”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [19]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisenone given

    As Alice and Bob train against three Eves, the model needs a lot of resources and time to be trained.

    “As Alice and Bob train against three Eves, the model needs a lot of resources and time to be trained.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [24]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S2 (checkable).

    Interpretationreasoning

    Neural networks based cryptographic models, with suitable enhancements and modifications, may be expected to provide a lightweight post-quantum secure primitive.

    “as the security is not based on any computational hardness assumption, neural networks based cryptographic models (with suitable enhancements and modifications) may be expected to provide a lightweight postquantum secure primitive.”
    Quote in the paperNot a substantial claim
    • Rests on an assumption: The security of neural networks based cryptographic models is not based on any computational hardness assumption.

  • May combine two claims.

    Premisecitation

    When Eve has only 4 bits of the key, Alice and Bob can beat her and the synchronization is successful with 100% accuracy for Bob and a little less than 50% accuracy for Eve.

    “We can see in figure 9 and 10 that when Eve has only 4 bits of the key, Alice and Bob can beat her and the synchronization is successful with 100% accuracy for Bob and a little less than 50% accuracy for Eve.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [18]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • May combine two claims.

    Premisecitation

    Zhou et al. proposed a security analysis as well as a follow-up work on the GAN-based encryption proposed by Abadi et al.

    “Zhou et al. [18] proposed a security analysis as well as a follow up work on the new way to do encryption based on GANs as proposed by Abadi et al. [13].”
    Quote in the paperNot a substantial claim0 of 2 sources checked
    • cites [18]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [13]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims. The quote only partly states this claim.

    Premisecitation

    In the experiment where Eve gets 16 bits of plaintext and the key, Bob has 100% accuracy while Eve has a little less than that.

    “We can see that Bob has a 100% accuracy while Eve has a little less than that.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [18]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Classified as probably not a substantial claim.

    Interpretationreasoning

    The GAN-based approach might prove useful against quantum computers because the model learned does not depend on a difficult mathematical problem.

    “Opened the path to a new way to use GANs which might prove useful against quantum computers as the model learned does not depend on a difficult mathematical problem.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Premisecitation

    Chong et al.'s Generative Adversarial Privacy model can protect data and anonymize it properly while preserving its utility.

    “through what they called Generative Adversarial Privacy (GAP) the authors built a model that can protect the data and anonymize it properly while preserving its utility.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [41]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • Rests on an assumption: Training neural network models requires having on hand a lot of data, and this data is generally difficult to acquire due to privacy problems.

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Premisenone given

    Research in neural network based cryptography is still in a nascent stage.

    “However, the research in this field is still in a nascent stage and several developments in different fronts are observed on a regular basis.”
    Quote in the paperNot a substantial claim
53 of 53

  • The paper relies on this without support.

    The interest in neural network based cryptography took a dip because simple computations, even XOR, could not be computed by simple neural networks.

    “The interest in neural network based cryptography took a dip because of the fact that simple computations, even as basic as exclusive-or (XOR) operation could not be computed by simple neural networks.”

  • The paper relies on this without support.

    The one time pad is based on a pseudo-random generator which still makes it vulnerable when not using quantum computers.

    “The one time pad is based on a pseudo-random generator which still makes it vulnerable when not using quantum computers.”

  • The paper relies on this without support.

    The ciphertexts generated by Abadi et al.'s model have many repetitive patterns.

    “The ciphertexts generated have many repetitive patterns.”

  • The paper relies on this without support.

    Training neural network models requires having on hand a lot of data, and this data is generally difficult to acquire due to privacy problems.

    “Training neural network models requires having on hand a lot of data.This data is generally is difficult to acquire due to privacy problems.”

  • The paper relies on this without support.

    Neural network models are usually lightweight, fast and efficient.

    “As Neural Network models are usually lightweight, fast and efficient, the first possible usage case is to apply the learned protocols between IoT devices.”

  • The paper relies on this without support.

    The security of neural networks based cryptographic models is not based on any computational hardness assumption.

    “as the security is not based on any computational hardness assumption, neural networks based cryptographic models (with suitable enhancements and modifications) may be expected to provide a lightweight postquantum secure primitive.”

  • The paper relies on this without support.

    Classical computers cannot generate a fully random pattern.

    “As classical computers cannot generate a fully random pattern, the model will not prove useful unless used with a quantum computer.”
7 of 7

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

Each contradiction between two passages listed here was confirmed by an independent check.

  • Topology-evolving cryptography paper has the wrong reference number

    Minor

    The summary cites [23] for the topology-evolving neural cryptography paper, but reference [23] is a different paper. The matching paper is listed as reference [37].

  • Publication year for the Kanter paper differs between table and reference

    Minor

    The table places the cited paper in 2001, whereas its reference entry dates it to 2002.

  • Publication year for the Zhou paper differs between summary and reference

    Minor

    The summary labels the cited work as 2018, but its reference entry gives 2019.

3 of 3

Cites

Flagged first, then by citations

Cited by

Sorted by citations

Related

Authors
Meraouche, I., Dutta, S., Tan, H., & Sakurai, K.
Affiliations
  • Kyushu University (JP)
  • University of Calgary (CA)
ORCID
Venue
IEEE Access
Publisher
Institute of Electrical and Electronics Engineers (IEEE)
Published
2021
Volume
9
Pages
124727-124740
ISSN
2169-3536 (ISSN-L)
DOI
10.1109/access.2021.3109635
OpenAlex
W3197555326
Semantic Scholar
41bea0586e8421d68b6221f0dfb0aa98c41a2f53
Cited by
52
References
48
Citations by year
2026: 8 · 2025: 12 · 2024: 15 · 2023: 9 · 2022: 8
FWCI
2.78
Type
journal article
Language
en
Open access
Licence
Locations
  • IEEE Access (publishedVersion, cc-by)
  • DOAJ (DOAJ: Directory of Open Access Journals) (submittedVersion, cc-by-sa)
Funders
  • Ministry of Education, Culture, Sports, Science and Technology
  • Japan Science and Technology Agency
  • Strategic International Collaborative Research Program
Topics
  • Physical Sciences › Computer Science › Artificial Intelligence › Cryptography and Data Security
  • Physical Sciences › Computer Science › Artificial Intelligence › Cryptographic Implementations and Security
  • Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
Keywords
generative adversarial networks

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Claims read by deepseek-v4.1-flash under definition version 3 (extract-v3) on 2026-10-23.

Classified by jev-1.13-20260917 (gold-guideline-v0.2) on 2026-10-23.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review